URL:

http://f.c2r.ts.cdn.office.net/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be/Office/Data/16.0.17425.20008/i640.cab

Full analysis: https://app.any.run/tasks/29503abf-c391-4d6e-8e7b-c9848b9783e2
Verdict: Malicious activity
Analysis date: March 13, 2024, 18:11:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

DCBE32F92432F83BBB071355316531F1

SHA1:

218CEF130A430A1A69422CE5D836CE57A8AFB3AB

SHA256:

E5DD0F007752CAF1AD5126FFE7DB82F5631774FB5CCCE0FAA41C0A9B75979E5F

SSDEEP:

3:N1KYLYwyQpuIWBcsSdEddRuiSAxyROLhNoV6Miun:CYLY5CpW9uEfojROLhNogun

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 116)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 116)

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 116)

    • Creates file in the systems drive root

      • WinRAR.exe (PID: 116)

    • Reads Internet Explorer settings

      • WinRAR.exe (PID: 116)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3672)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3672)
      • WinRAR.exe (PID: 116)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3672)

    • Manual execution by a user

      • explorer.exe (PID: 956)

    • Checks proxy server information

      • WinRAR.exe (PID: 116)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 116)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\i640.cab"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
956"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3672"C:\Program Files\Internet Explorer\iexplore.exe" "http://f.c2r.ts.cdn.office.net/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be/Office/Data/16.0.17425.20008/i640.cab"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3692"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 283
Read events
24 996
Write events
249
Delete events
38

Modification events

(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31094129
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31094129
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
225
Suspicious files
18
Text files
34
Unknown types
4

Dropped files

PID
Process
Filename
Type
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\i640[1].cabcompressed
MD5:D299186A7A7AFCDC3E530947B94F95AC
SHA256:9E23BB89EC4103D073ED731CE75C2B0025BCCCD59AA5659564CE9C9936338A21
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{1CBD39F9-E165-11EE-AE0A-12A9866C77DE}.datbinary
MD5:9D3DA14EE2BB13EA39A0465DBB6D450C
SHA256:398F1D37E23FC3393BCB2977C124D51964BB8CBBD033F2D3B06E7D1A44629B61
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8BD9D0556C2B74C4.TMPbinary
MD5:A507705D9BBC188C22C11FAAB9C0F6F8
SHA256:CE560CDBE5D08A419C2354105F045E5FE56602B68CD6413C0AE2B6FB3A96FE0B
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\7LU0L7TA.txttext
MD5:0C9B1732B4626F4952480C7F17319A07
SHA256:5EE5BF91194C07D50E429BF126A5993F233F6CD5D23330006273B621220EA8D2
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:2F66AE4DDF4D862B5B8F18E07EE9509E
SHA256:301D02C79A0814521AB733FB9A4F71265BBDC8237945185B586C509A9ADB8259
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\XR790MXR.txttext
MD5:8A9767A147D3519695232C58AAB835B6
SHA256:E398BD2C25784585E1620BB3A79036875A9E75752BE79F0363D68DBDEAA2286A
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\V5YRH0DR.txttext
MD5:3448D74C404C7A02B36DF4E24C0195AB
SHA256:859CC6E3EA0EB9513B040AC177EDC002E6E6F716DB2420FDC52244666A81C5F2
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\OCGMFL5B.txttext
MD5:384A32C1D8193044890F81C09C36A708
SHA256:3EEF9BE0287DC840FF0975F1BC9C723AEC4A4FBDCC12B1D05E0F20AAC1BDFECC
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\GUL6FW7C.txttext
MD5:BBAED0E37ABB31192108FD22B9412C77
SHA256:CB95C2EA698EC63BC2C3667A38E4DB4636AF884C78638F74E85A5E7E6DDDD9E3
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\i640.cab —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
32
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
unknown
3692
iexplore.exe
GET
200
23.50.131.218:80
http://f.c2r.ts.cdn.office.net/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be/Office/Data/16.0.17425.20008/i640.cab
DE
compressed
32.0 Mb
unknown
3672
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
binary
471 b
unknown
3672
iexplore.exe
GET
304
23.48.23.67:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18014fff35250a83
DE
—
—
unknown
3672
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
binary
471 b
unknown
3672
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
unknown
3672
iexplore.exe
GET
304
23.48.23.7:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70b4a85d87201c80
DE
—
—
unknown
3692
iexplore.exe
GET
—
23.50.131.218:80
http://f.c2r.ts.cdn.office.net/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be/Office/Data/16.0.17425.20008/i640.cab
DE
—
—
unknown
1080
svchost.exe
GET
200
23.48.23.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e90c163b6659448e
DE
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3692
iexplore.exe
23.50.131.218:80
f.c2r.ts.cdn.office.net
Akamai International B.V.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3692
iexplore.exe
23.50.131.200:80
f.c2r.ts.cdn.office.net
Akamai International B.V.
DE
unknown
3672
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3672
iexplore.exe
23.48.23.8:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3672
iexplore.exe
23.48.23.67:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3672
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
f.c2r.ts.cdn.office.net
  • 23.50.131.218
  • 23.50.131.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 23.48.23.67
  • 23.48.23.8
  • 23.48.23.7
  • 23.48.23.21
  • 23.48.23.51
  • 23.48.23.18
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://f.c2r.ts.cdn.office.net/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be/Office/Data/16.0.17425.20008/i640.cab